replication

Author: BertrandGouny

README.md

@@ -11,7 +11,7 @@ Add support of tls. Use docker 1.5.0
 ## Quick start
 Run OpenLDAP docker image :
 
-	docker run -d osixia/openldap
+	docker run -h ldap.example.org -d osixia/openldap
 
 This start a new container with a OpenLDAP server running inside.
 The odd string printed by this command is the `CONTAINER_ID`.
@@ -25,7 +25,7 @@ make sure to replace `CONTAINER_ID` by your container id :
 You should now be in the container terminal,
 and we can search on the ldap server :
 
-	ldapsearch -x -h 127.0.0.1 -b dc=example,dc=org -D "cn=admin,dc=example,dc=org" -w admin
+	ldapsearch -x -h ldap.example.org -b dc=example,dc=org -D "cn=admin,dc=example,dc=org" -w admin
 
 This should output :
 
@@ -56,7 +56,7 @@ It will create an empty ldap for the compagny **Example Inc.** and the domain **
 
 By default the admin has the password **admin**. All those default settings can be changed at the docker command line, for example :
 
-	docker run -e LDAP_ORGANISATION="My Compagny" -e LDAP_DOMAIN="my-compagny.com" \
+	docker run -h ldap.example.org -e LDAP_ORGANISATION="My Compagny" -e LDAP_DOMAIN="my-compagny.com" \
 	-e LDAP_ADMIN_PASSWORD="JonSn0w" -d osixia/openldap
 
 #### Data persitance
@@ -77,7 +77,7 @@ Assuming you have a LDAP database on your docker host in the directory `/data/sl
 and the corresponding LDAP config files on your docker host in the directory `/data/slapd/config`
 simply mount this directories as a volume to `/var/lib/ldap` and `/etc/ldap/slapd.d`:
 
-	docker run -v /data/slapd/database:/var/lib/ldap \
+	docker run -h ldap.example.org -v /data/slapd/database:/var/lib/ldap \
 	-v /data/slapd/config:/etc/ldap/slapd.d
 	-d osixia/openldap
 
@@ -87,17 +87,17 @@ You can also use data volume containers. Please refer to :
 ### Using TLS
 
 #### Use autogenerated certificate
-By default TLS is enable, a certificate is created for the CN (common name) ldap.example.org. To work properly on your server adjust SERVER_NAME environment variable to match the ldap server CN.
+By default TLS is enable, a certificate is created with the container hostname eg: ldap.example.org.
 
-	docker run -e SERVER_NAME=ldap.my-compagny.com -d osixia/openldap
+	docker run -h ldap.example.org -e SERVER_NAME=ldap.my-compagny.com -d osixia/openldap
 
 #### Use your own certificate
 
 Add your custom certificate, private key and CA certificate in the directory **image/service/slapd/assets/ssl** adjust filename in **image/env.yml** and rebuild the image ([see manual build](#manual-build)).
 
 Or you can set your custom certificate at run time, by mouting a directory containing thoses files to **/osixia/slapd/assets/ssl** and adjust there name with the following environment variables :
 
-	docker run -v /path/to/certifates:/osixia/slapd/assets/ssl \
+	docker run -h ldap.example.org -v /path/to/certifates:/osixia/slapd/assets/ssl \
 	-e SSL_CRT_FILENAME=my-ldap.crt \
 	-e SSL_KEY_FILENAME=my-ldap.key \
 	-e SSL_CA_CRT_FILENAME=the-ca.crt \
@@ -106,7 +106,7 @@ Or you can set your custom certificate at run time, by mouting a directory conta
 #### Disable TLS
 Add -e USE_TLS=false to the run command :
 
-	docker run -e USE_TLS=false -d osixia/openldap
+	docker run -h ldap.example.org  -e USE_TLS=false -d osixia/openldap
 
 ## Administrate your ldap server
 If you are looking for a simple solution to administrate your ldap server you can take a look at our phpLDAPadmin docker image :
@@ -129,18 +129,17 @@ TLS options :
 - **SSL_CRT_FILENAME**: Ldap ssl certificate filename. Defaults to `ldap.crt`
 - **SSL_KEY_FILENAME**: Ldap ssl certificate private key filename. Defaults to `ldap.key`
 - **SSL_CA_CRT_FILENAME**: Ldap ssl CA certificate  filename. Defaults to `ca.crt`
-- **SERVER_NAME**: Use by autogenerated certificate: Server CN. Defaults to `ldap.example.org`
 
 ### Set environment variables at run time :
 
 Environment variable can be set directly by adding the -e argument in the command line, for example :
 
-	docker run -e LDAP_ORGANISATION="My Compagny" -e LDAP_DOMAIN="my-compagny.com" \
+	docker run -h ldap.example.org -e LDAP_ORGANISATION="My Compagny" -e LDAP_DOMAIN="my-compagny.com" \
 	-e LDAP_ADMIN_PASSWORD="JonSn0w" -d osixia/openldap
 
 Or by setting your own `env.yml` file as a docker volume to `/etc/env.yml`
 
-	docker run -v /data/my-ldap-env.yml:/etc/env.yml \
+	docker run -h ldap.example.org -v /data/my-ldap-env.yml:/etc/env.yml \
 	-d osixia/openldap
 
 ## Manual build
@@ -165,7 +164,7 @@ Build your image :
 
 Run your image :
 
-	docker run -d billy-the-king/openldap:0.1.0
+	docker run -h ldap.example.org -d billy-the-king/openldap:0.1.0
 
 ## Tests
 

image/Dockerfile

@@ -13,7 +13,7 @@ RUN apt-get -y update && /sbin/enable-service ssl-kit \
 	slapd ldap-utils ntp \
 	&& rm -rf /var/lib/ldap /etc/ldap/slapd.d
 
-# Add services to /osixia
+# Add service directory to /osixia
 ADD service /osixia
 
 # Use baseimage service auto-install script and clean all

image/env.yml

@@ -13,14 +13,14 @@ SSL_CA_CRT_FILENAME: ca.crt
 
 
 USE_REPLICATION: false
-# variables $BASE_DN, $LDAP_ADMIN_PASSWORD and $LDAP_CONFIG_PASSWORD
+# variables $BASE_DN, $LDAP_ADMIN_PASSWORD, $LDAP_CONFIG_PASSWORD and $SSL_*
 # are automaticaly replaced at run time
 
 # if you want to add replication to an existing ldap
 # adapt REPLICATION_CONFIG_SYNCPROV and REPLICATION_HDB_SYNCPROV to your configuration
 # avoid using $BASE_DN, $LDAP_ADMIN_PASSWORD and $LDAP_CONFIG_PASSWORD variables
-REPLICATION_CONFIG_SYNCPROV: binddn="cn=admin,cn=config" bindmethod=simple credentials=$LDAP_CONFIG_PASSWORD searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1
-REPLICATION_HDB_SYNCPROV: binddn="cn=admin,$BASE_DN" bindmethod=simple credentials=$LDAP_ADMIN_PASSWORD searchbase="$BASE_DN" type=refreshAndPersist interval=00:00:00:10 retry="5 5 300 5" timeout=1
+REPLICATION_CONFIG_SYNCPROV: binddn="cn=admin,cn=config" bindmethod=simple credentials=$LDAP_CONFIG_PASSWORD searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 starttls=critical
+REPLICATION_HDB_SYNCPROV: binddn="cn=admin,$BASE_DN" bindmethod=simple credentials=$LDAP_ADMIN_PASSWORD searchbase="$BASE_DN" type=refreshAndPersist interval=00:00:00:10 retry="5 5 300 5" timeout=1  starttls=critical
 REPLICATION_HOSTS:
   - ldap://ldap.example.org # The order must be the same on all ldap servers
   - ldap://ldap2.example.org